Networks commonly use the Dynamic Host Configuration Protocol (DHCP) to assign and manage internet protocol (IP) addresses in networks. Typically, the DHCP service is provided by DHCP server software on a computing device referred to as a DHCP server. When a new endpoint (e.g., PC or notebook computer) attaches to a network, the endpoint broadcasts a “DHCPDISCOVER” packet to initiate contact with a DHCP server and obtain dynamic assignment of an IP address. The DHCPDISCOVER packet includes the Media Access Control (MAC) address of the endpoint.
If there is no DHCP server to receive the broadcast on a local segment to which the endpoint is attached, the DHCPDISCOVER packet may be relayed between networks by a DHCP relay, which may be present in a router, network appliance, or other device on the local segment. If this occurs, the DHCP relay will add its own relay IP address to the DHCPDISCOVER packet so that DHCP servers will be able to send a reply to the endpoint back through the DHCP relay.
When a DHCP server receives a DHCPDISCOVER packet, the DHCP server responds with a “DHCPOFFER” packet. The DHCPOFFER packet includes a proposed IP address and the DHCP server stores a record associating the proposed IP address with a MAC address of the endpoint. Several DHCP servers may receive a copy of the same DHCPDISCOVER packet and each DHCP server my respond with a “DHCPOFFER” packet.
When an endpoint receives one or more DHCPOFFER packets it can accept one of the received DHCPOFFERs by broadcasting a “DHCPREQUEST” containing the desired IP address. The DHCP server that sent the corresponding DHCPOFFER packet will then respond with a “DHCPACK” packet, which assigns the associated IP address to the endpoint.
The IP address included in a DHCPOFFER packet is selected from one or more address range(s) in a matching “scope.” A scope contains a range of IP addresses and a set of criteria. The criteria are optionally compared with data (e.g., DHCP options) within a DHCPDISCOVER packet in order to determine which scope(s) to select an IP address from for inclusion is a resulting DHCPOFFER packet. Thus, on set of DHCP options in a DHCPDISCOVER packet may result in selection of an IP address from a first scope and a different set of DHCP options in a DHCPDISCOVER packet may result in selection of an IP address from a second scope. The scopes are stored in an address allocation table in association with the DHCP server. Some, none, or all of the IP addresses within a scope may be available depending on whether the addresses have been previously assigned to other endpoints.
Upon receiving the DHCPDISCOVER packet, the DHCP server must determine which scope to select an unused IP address from, based on one or more criteria (e.g., DHCP options). The specific criteria available for selecting scopes varies depending on DHCP server implementations, but the scopes are assigned based on the contents of the DHCPDISCOVER packet. The criteria may include a Relay IP address or lack thereof.
A Relay IP address is inserted into DHCPDISCOVER and DHCPREQUEST packets by a DHCP relay before relaying the packets. The Relay IP address ensures the DHCP server knows where to send the responses. DHCP relays are used on segments where DHCP servers are not present. When a DHCPDISCOVER or DHCPREQUEST packet lacks a Relay IP address, this indicates that the DHCP server received the packet from a local segment, without going through a DHCP relay. This implies that the DHCP server should use the local scope associated with one of its network interface cards.
Many models of routers and switches can be configured to selectively block network packets originating from endpoints. The selective blocking of endpoint traffic, also known as filtering, is based on the contents of the packet and its origination. The contents may include source and destination IP address, protocol (e.g. IGMP, ICMP, TCP, UDP, . . . ), the port number (TCP or UDP port number), and other fields within the packet. However, setup and management of these blocking features is a laborious non-dynamic task and may require undesirable changes in infrastructure. There is, therefore, a need for improved methods of selectively blocking network packets.